Privacy
Policy.

Information we collect

We may collect identity and contact details, service related information, financial and payment information, digital information, recordings, professional information for job applicants and workers, and special category data where legally permitted.

Identity and contact details

• Name, address, email address and phone number.
• Professional details.

Service related information

• Transaction details for products and services you have purchased from us or enquiries about our services.
• Your preferences for our services and your marketing preferences, and where relevant information related to loyalty programmes.
• Feedback, complaints, compliments and survey responses.
• Application and profile information, including your role, business, funding needs, investment preferences and partnership interests; documents you upload, such as pitch decks; and messages you exchange with gigi.

Financial and payment information

• Payment details for products and services you have purchased from us (including, where relevant, credit reference information), and where relevant banking or payment card information.

Digital information

• IP address and general location information derived from it.
• Technical connection, security and service activity records.
• Sign-in information and settings stored in your browser.

Calls, meetings and shared content

• Live call audio, call recordings and uploaded voice notes.
• Transcripts, conversation summaries, records of meetings and decisions, and information extracted to update your profile or support matching.
• Images from a tab, window or screen you choose to share during a browser call, and presentation materials supplied for an gigi demo.

Professional information for job applicants and workers

• Employment history.
• Professional experience.
• Required authorisations and licences.
• Professional registrations.
• Information about your right to work in the UK.

Special category data

This is special information that the law says is more sensitive (sometimes called sensitive personal data). We handle special category data with extra care and protection, and we only collect and use it where legally permitted. This includes:

• Racial or ethnic origin.
• Religious, political or philosophical beliefs.
• Trade union membership.
• Genetic data, and biometric data used to uniquely identify a person.
• Health information, including dietary requirements, allergies and health conditions.
• Information that could identify aspects of your sex life.
• Sexual orientation.

Information about criminal allegations, proceedings or convictions is subject to separate legal protections. If we process this information, we do so only where legally permitted and with the required safeguards.

How we collect personal data

• Directly from you when you interact with us, contact us, or fill out forms.
• Automatically when you visit our website, use our technologies such as AI tools, or interact with our online services such as when liaising and conducting meetings with gigi.
• From third parties including service providers (such as your CRM provider when you connect with gigi), business partners, previous employers, government organisations, and organisations or people authorised by you.
• From publicly available sources such as Companies House and professional networking sites such as LinkedIn.

How we use your information

Data protection law requires us to have proper legal reasons for using your personal data. We can only use your information when we have one or more of these legal bases:

• Consent - you have clearly agreed to us using your personal data for a specific purpose.
• Performance of a contract - we need to use your information to fulfil a contract with you, or because you have asked us to do something before entering into a contract.
• Legal duty - we must use your information to comply with the law.
• Vital interests - we need to use your information to protect someone's life.
• Public interest - we need to use your information to perform a task in the public interest or carry out official functions that have a clear legal basis.
• Legitimate interests - we have a genuine business reason to use your information, or a third party does, but only if this does not unfairly override your rights and interests.

Where we rely on legitimate interests as our legal basis, we conduct balancing tests to ensure our interests do not override your fundamental rights and freedoms. These assessments consider the nature of our legitimate interest, the impact on you, any safeguards we can implement, your reasonable expectations, and the broader context of our relationship.

We may process your personal data for more than one legal basis, depending on the specific purpose for which we are using your data. Please reach out to us if you need further details about the specific legal basis we are relying on to process your personal data.

Managing your account and providing our services

We use your information:

• To enable you to access and use our software, including providing login credentials.
• To provide our services to you, including appointment management.
• To contact and communicate with you about our services, including responding to support requests and enquiries and dealing with complaints or claims.
• For internal record keeping, administrative, invoicing and billing purposes.

The legal bases for using this information are performance of a contract, legal duty for billing and record-keeping requirements, and legitimate interests. The types of information we use are identity and contact details, service related information, financial information, and digital information.

Client onboarding and verification

We use your information to assess whether to take you on as a new client, including performing anti-money laundering, anti-terrorism, sanction screening, fraud and other background checks.

The legal bases for using this information are performance of a contract, legal duty, public interest and legitimate interests. The types of information we use are identity and contact details and financial information.

Website enquiries and customer service

We use your information to contact and communicate with you about any enquiries you make with us via our website.

The legal basis for using this information is legitimate interests. The types of information we use are identity and contact data and digital information.

Business improvement and development

We use your information for:

• Analytics, including profiling on our website.
• Market research and business development.
• Operating and improving our services, associated applications and associated social media platforms.

The legal basis for using this information is legitimate interests. The type of information we use is digital information.

Marketing and communications

We use your information:

• To send you promotional information about our events and experiences and information that we consider may be of interest to you.
• To run promotions, competitions and offer additional benefits to you.

The legal basis for using this information is legitimate interests. The types of information we use are identity and contact data and digital information.

Recruitment and employment purposes

We use your information:

• To consider your application if you have applied to work with us and to keep you up to date with its progress.
• In relation to self-declared disabilities in order for us to make reasonable adjustments to support your application and any possible future employment.
• In relation to any diversity or equal opportunities monitoring questionnaire data, to monitor and report on our equality and diversity composition and ensure fairness in the recruitment process.
• In relation to any right to work information we collect, in order to ensure we comply with the law in employing you.
• To keep you updated on any other suitable vacancies.

The legal bases for using this information are legitimate interests, legal duty, consent and performance of a contract. The types of information we use are identity and contact data and professional data.

Legal compliance

We use your information to comply with our legal obligations or if otherwise required or authorised by law.

The legal basis for using this information is legal duty. The types of information we use are all relevant personal data.

Automated decision making and profiling

Our platform uses automated processing to help route founders, investors and other members of our network to relevant connections. This processing is designed to support, not replace, human judgement. You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where we use automated decision-making, we will:

• Inform you of the logic involved.
• Explain the significance and envisaged consequences.
• Provide you with the right to human intervention.
• Allow you to express your point of view.
• Enable you to contest the decision.

Our disclosures of personal data to third parties

We may disclose personal data to:

• Hosting and data storage providers, including Railway (including managed Postgres) and Convex, which support our website, applications and stored service records.
• Google Gemini for AI processing, including live voice conversations, transcription and other enabled AI features. OpenAI may process data where an OpenAI-powered feature or alternative voice configuration is enabled; Gemini is currently used for gigi live voice.
• Telnyx for telephone and browser calls, and Recall.ai for gigi to join and receive audio in supported online meetings.
• Cloudflare for website security and form protection, and Resend for service emails.
• Google Calendar and Gmail APIs when you choose to connect those services, as explained below.
• Payment processors, where a service involves a payment.
• Professional advisers including bankers, auditors, insurers, insurance brokers and legal advisers.
• Business partners, our existing or potential agents, and our business partners or contractors.
• Parties involved in corporate transactions. If we merge with or are acquired by another company, or sell our business assets, your information may be disclosed to our advisers, the potential purchaser's advisers, and may be included in the transferred assets.
• Legal and regulatory bodies, including courts and tribunals, regulatory authorities where required for reporting obligations, and law enforcement officers.
• Other parties, including third parties you have authorised, emergency services when necessary, and any other parties as required or permitted by law.

Overseas transfers

gigi is based in the United Kingdom. Your personal data may be stored or processed in the United Kingdom and other countries, depending on the service and provider involved. International processing can occur when we use cloud hosting, AI, communications and connected-account services, work with overseas business partners, or comply with legal requirements.

When we transfer your personal data outside the United Kingdom, we ensure it receives appropriate protection by only transferring your information to countries that UK data protection law recognises as providing adequate protection for personal data, by putting in place a contract with the third party that means they must protect personal data to the same standards as the UK, or by transferring personal data to organisations that are part of specific agreements on cross-border data transfers with the UK.

We only transfer the minimum amount of personal data necessary and require all recipients to protect your information to the same standards required by UK law, use your information only for the purposes we have agreed, allow us to monitor how they handle your information, and provide you with the same rights over your information that you have under UK law.

Data retention

We only keep your personal data for as long as we need it to provide our services to you, meet our legal, tax, accounting or regulatory obligations, or handle any complaints or legal issues that may arise.

Raw Telnyx call recordings and uploaded voice-note audio are scheduled for deletion after 30 days. Provider or technical failures can delay completion of deletion. Transcripts, summaries, profile information and other service records are stored separately and are not deleted simply because the original audio is deleted. We retain those records according to the purposes and criteria in this section.

We may keep your information for longer if:

• You make a complaint that we need to investigate or respond to.
• We reasonably believe legal action involving our relationship with you might occur.
• The law requires us to keep it for specific timeframes.

When determining how long to keep your information, we consider:

• How much information we have and how sensitive it is.
• The risk of harm if the information was accessed without permission.
• Whether we can achieve our purposes in other ways.
• What legal, regulatory, tax or accounting rules require.
• The nature of our relationship with you and the services we provide.

Once we no longer need your personal data, we will securely delete or destroy it in accordance with our data retention policies and legal requirements. You can request information about retention periods for your data and ask for early deletion where legally possible.

Your privacy rights and choices

You can choose whether to provide personal data to us. However, if you do not provide certain information, we may not be able to provide some services. Let us know if you do not want to provide information and we will let you know when information is required versus optional.

• Right of access: you have the right to ask us for copies of your personal data. You can request other information such as details about where we get personal data from and who we share personal data with. There are some exemptions which means you may not receive all the information you ask for.
• Right to rectification: you have the right to ask us to correct or delete personal data you think is inaccurate or incomplete.
• Right to erasure: you can request deletion of your personal data in certain limited circumstances as set out in data protection law, such as where the data is no longer necessary or has been unlawfully processed. This right is not absolute and we may be required or entitled to retain your data for legal, regulatory or legitimate business reasons.
• Right to restrict processing: you can ask us to suspend processing where you contest the accuracy of the data, processing is unlawful but you do not want erasure, we no longer need the data but you need it for legal claims, or you have objected to processing pending verification of our legitimate grounds.
• Right to opt out of marketing communications: you can opt out of receiving marketing communications at any time. Each marketing communication will include an unsubscribe option. You can change your marketing preferences by contacting us. We will process your request as soon as practicable.
• Right to data portability: where technically feasible, you can receive your personal data in a structured, commonly used format or have it transmitted to another controller where processing is based on consent or contract and processing is automated.
• Right to object: you can object to processing based on legitimate interests for reasons relating to your situation. We will stop unless we can demonstrate overriding compelling grounds, or need the data for legal claims. You can also object to direct marketing, including associated profiling, at any time. If you do, we will stop using your data for that purpose.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us using the details below. We may ask for proof of identity and will respond within one month, extendable to three months for complex requests. These rights are available under data protection law, though some may not apply in every situation. We will let you know if any limitations apply when you make a request.

Making a complaint

If you have concerns about how we handle your information, please get in touch with us first using the contact details at the end of this policy. When you contact us, give us full details about your complaint. We will investigate your concerns promptly and respond to you in writing explaining what we found and what we will do to address your complaint.

You can also make a complaint directly to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

You do not have to contact us first before going to the ICO, but we would appreciate the opportunity to try to resolve your concerns directly with you.

Protecting your information

We use multiple layers of security to protect your information.

Technical safeguards

• Enterprise-grade encryption for data storage and transmission.
• Regular security testing and monitoring.
• Automated threat detection systems.

Operational security

• Staff training on security and privacy.
• Strict access controls based on job requirements.
• Regular security audits and incident response procedures testing.

Physical security

• Secure premises with controlled access.
• Secure disposal of physical documents.
• Equipment security protocols.

Please note that any information you choose to share publicly on online platforms, such as comments or reviews, can be accessed and used by others. We cannot control or protect information that you make publicly available.

Cookies and analytics

Our website currently uses necessary technologies for sign-in, security, form submission and remembering settings, including browser storage and Cloudflare Turnstile. Browser storage also remembers when you dismiss our cookie notice.

We do not currently use analytics or marketing cookies, Google Analytics or Meta Pixel on this website. Our cookie notice explains the necessary technologies in use; it is not an optional-cookie preference centre.

You can clear or block cookies and browser storage in your browser settings. This may sign you out or affect features such as secure form submission. If we introduce optional tracking technologies, we will update this notice and obtain consent where required.

Connected Google accounts

Connecting Google Calendar or Gmail is optional. When you connect a service, Google shows the permissions requested. We receive the connected account details and access credentials needed to provide the features you authorise.

Calendar access lets us retrieve event details for scheduling and meeting-related features. Gmail access lets us retrieve message details, including senders, recipients, subject lines, dates, snippets and selected message content. We use this information to organise relevant conversations, update your workspace and pipelines, and support AI-assisted summaries or reply drafts. Sending through your Gmail account requires the relevant permission and a separately enabled sending feature.

You can disconnect a service in gigi. Disconnecting removes our stored connection credentials and imported Calendar events or Gmail message records, as applicable. It does not delete the original messages or events in your Google account. You can also revoke gigi access in your Google account settings. Contact us if you want to request deletion of other information derived from your use of these features.

Location information

We use the location and geographic preferences you provide, such as your city, country, business location or investment markets, to help identify relevant connections. Technical connection information such as an IP address may also indicate an approximate location.

Our website does not currently request your device's GPS location. You can ask us to correct the location information in your profile or contact us about its use.

Artificial Intelligence (AI) Technologies

We use artificial intelligence and machine learning technologies in our business operations and services, including AI tools provided by third parties. We only use these technologies when legally permitted and necessary for our business.

gigi is an AI assistant. For live voice conversations, we send audio and relevant context, such as your application, profile, conversation history or workspace information, to Google Gemini so gigi can respond to you. Saved recordings and voice notes may also be processed to produce transcripts, summaries and profile updates. Text conversations and other AI-assisted features use the information relevant to your request, which may include documents or connected-account content.

During a browser call, screen sharing starts only when you choose to share and grant permission through your browser. Images from the tab, window or screen you select are sent to the AI provider as live visual context. You can stop sharing at any time. For gigi presentation demos in online meetings, gigi receives audio and its own presentation content; that feature does not give gigi access to participants' screens.

We may use AI technologies to:

• Conduct analysis and data processing.
• Generate and modify content and code.
• Improve and optimise our services and operations.
• Automate routine tasks and communications.
• Personalise your experience with our services.
• Support quality assurance processes.
• Assist with customer support and queries.

When we work with third-party AI providers, we ensure they handle your personal data in accordance with privacy laws through contractual requirements and appropriate safeguards.

Any information generated or inferred about you by AI technologies is treated as personal data, and you maintain all the rights outlined in this privacy policy.

When using AI with your personal data, we commit to:

• Informing you when AI is used to make decisions that may significantly affect you.
• Maintaining human oversight and review of significant AI-generated decisions.
• Training our staff to understand AI limitations and verify outputs before relying on them.
• Implementing processes to verify AI-generated outputs.
• Using appropriate technical and organisational measures to maintain the security and integrity of your personal data.
• Regularly testing and monitoring AI outputs for accuracy and reliability.
• Regularly assessing and documenting risks associated with using AI to process personal data.
• Implementing appropriate measures to address these risks.
• Continuously monitoring AI performance and regularly reviewing its impact.

Amendments

We may update this policy at any time by posting the revised version on our website. We recommend that you review our website regularly to stay current with any policy changes.

Our contact details

Privacy contact email: humans@iriscapital.ai

Last updated: 18 September 2026.